製品・ソフトウェアに関する情報

JVN脆弱性詳細

OpenSSH のクライアントの roaming_common.c の roaming_read および roaming_write 関数におけるサービス運用妨害 (DoS) の脆弱性

Title	OpenSSH のクライアントの roaming_common.c の roaming_read および roaming_write 関数におけるサービス運用妨害 (DoS) の脆弱性
Summary	OpenSSH のクライアントの roaming_common.c の (1) roaming_read および (2) roaming_write 関数は、特定のプロキシおよび転送オプションが有効になっている場合、接続ファイル記述子を適切に保持しないため、サービス運用妨害 (ヒープベースのバッファオーバーフロー) 状態にされるになど、不特定の影響を受ける脆弱性が存在します。なお、JVNVU#95595627 では、CWE-122 として公開されています。 CWE-122: Heap-based Buffer Overflow http://cwe.mitre.org/data/definitions/122.html
Possible impacts	リモートサーバにより、大量の転送を要求されることで、サービス運用妨害 (ヒープベースのバッファオーバーフロー) 状態にされるになど、不特定の影響を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 14, 2016, midnight
Registration Date	Jan. 22, 2016, 1:52 p.m.
Last Update	Oct. 27, 2016, 6:07 p.m.

CVSS3.0 : 重要
Score	8.1
Vector	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS2.0 : 警告
Score	4.6
Vector	AV:N/AC:H/Au:S/C:P/I:P/A:P

Affected System

オラクル

Oracle Linux

Oracle Solaris

OpenBSD

OpenSSH 5.x

OpenSSH 6.x

OpenSSH 7.1p2 未満の 7.x

アップル

Apple Mac OS X 10.10.5

Apple Mac OS X 10.11 から 10.11.3

Apple Mac OS X 10.9.5

ソフォス

Sophos UTM ソフトウェア

ヒューレット・パッカード・エンタープライズ

HPE Remote Device Access: Virtual Customer Access System

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-0778	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0778
National Vulnerability Database (NVD)
2	CVE-2016-0778	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0778

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Apple Mailing Lists
1	APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
Apple Security Updates
2	HT206167	https://support.apple.com/en-us/HT206167
Apple セキュリティアップデート
3	HT206167	https://support.apple.com/ja-jp/HT206167
HPE Security Bulletin
4	HPSBGN03638	https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05247375
MIRACLE LINUX アップデート情報
5	AXSA:2016-037:01	https://tsn.miraclelinux.com/ja/node/6397
OpenSSH
6	release-7.1p2	http://www.openssh.com/txt/release-7.1p2
Oracle Technology Network
7	Oracle Linux Bulletin - January 2016	http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
8	Oracle Solaris Third Party Bulletin - October 2015	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
SOPHOS BLOG
9	UTM Up2Date 9.319 released	https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/
10	UTM Up2Date 9.354 released	https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/

その他

No	Name	URL
JVN
1	JVNVU#95595627	http://jvn.jp/vu/JVNVU95595627/index.html
2	JVNVU#97668313	http://jvn.jp/vu/JVNVU97668313
US-CERT Vulnerability Note
3	VU#456088	https://www.kb.cert.org/vuls/id/456088
関連文書
4	OpenBSD Journal	http://undeadly.org/cgi?action=article&sid=20160114142733
5	Qualys Security Advisory	https://www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt

Change Log

No	Changed Details	Date of change
0	[2016年01月22日] 掲載 [2016年03月29日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (HT206167) を追加ベンダ情報：アップル (APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002) を追加参考情報：JVN (JVNVU#97668313) を追加 [2016年05月31日] CVSS による深刻度：内容を更新ベンダ情報：ソフォス (UTM Up2Date 9.354 released) を追加ベンダ情報：ソフォス (UTM Up2Date 9.319 released) を追加 [2016年10月27日] CVSS による深刻度：内容を更新影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Linux Bulletin - January 2016) を追加ベンダ情報：ヒューレット・パッカード・エンタープライズ (HPSBGN03638) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-0778

Summary	The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.
Publication Date	Jan. 15, 2016, 7:59 a.m.
Registration Date	Jan. 26, 2021, 2:04 p.m.
Last Update	Nov. 21, 2024, 11:42 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:oracle:solaris:11.3:::::::*
cpe:2.3:o:oracle:linux:7:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:openbsd:openssh:5.4:::::::*
cpe:2.3:a:openbsd:openssh:5.5:::::::*
cpe:2.3:a:openbsd:openssh:6.6:::::::*
cpe:2.3:a:openbsd:openssh:6.7:::::::*
cpe:2.3:a:openbsd:openssh:5.4:p1::::::
cpe:2.3:a:openbsd:openssh:6.2:p1::::::
cpe:2.3:a:openbsd:openssh:6.9:::::::*
cpe:2.3:a:openbsd:openssh:6.8:p1::::::
cpe:2.3:a:openbsd:openssh:5.7:p1::::::
cpe:2.3:a:openbsd:openssh:6.0:::::::*
cpe:2.3:a:openbsd:openssh:6.3:::::::*
cpe:2.3:a:openbsd:openssh:6.1:p1::::::
cpe:2.3:a:openbsd:openssh:5.9:::::::*
cpe:2.3:a:openbsd:openssh:6.5:p1::::::
cpe:2.3:a:openbsd:openssh:6.1:::::::*
cpe:2.3:a:openbsd:openssh:6.3:p1::::::
cpe:2.3:a:openbsd:openssh:7.0:p1::::::
cpe:2.3:a:openbsd:openssh:5.6:p1::::::
cpe:2.3:a:openbsd:openssh:5.9:p1::::::
cpe:2.3:a:openbsd:openssh:7.1:::::::*
cpe:2.3:a:openbsd:openssh:5.8:::::::*
cpe:2.3:a:openbsd:openssh:6.0:p1::::::
cpe:2.3:a:openbsd:openssh:6.8:::::::*
cpe:2.3:a:openbsd:openssh:5.7:::::::*
cpe:2.3:a:openbsd:openssh:6.4:::::::*
cpe:2.3:a:openbsd:openssh:6.6:p1::::::
cpe:2.3:a:openbsd:openssh:6.5:::::::*
cpe:2.3:a:openbsd:openssh:6.7:p1::::::
cpe:2.3:a:openbsd:openssh:6.2:::::::*
cpe:2.3:a:openbsd:openssh:7.0:::::::*
cpe:2.3:a:openbsd:openssh:5.8:p1::::::
cpe:2.3:a:openbsd:openssh:6.9:p1::::::
cpe:2.3:a:openbsd:openssh:7.1:p1::::::
cpe:2.3:a:openbsd:openssh:5.5:p1::::::
cpe:2.3:a:openbsd:openssh:5.6:::::::*
cpe:2.3:a:openbsd:openssh:6.4:p1::::::
cpe:2.3:a:openbsd:openssh:6.2:p2::::::

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:apple:mac_os_x::::::::	10.9.0	10.9.5
cpe:2.3:o:apple:mac_os_x::::::::	10.10.0	10.10.5
cpe:2.3:o:apple:mac_os_x::::::::	10.11.0	10.11.3

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:hp:virtual_customer_access_system::::::::			15.07

Configuration5		or higher	or less	more than	less than
cpe:2.3:a:sophos:unified_threat_management_software:9.353:::::::*

Related information, measures and tools

No	URL	タグ
1	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734	Third Party Advisory
2	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734	Third Party Advisory
3	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	Mailing List Release Notes Third Party Advisory
4	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	Mailing List Release Notes Third Party Advisory
5	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html	Mailing List Third Party Advisory
6	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html	Mailing List Third Party Advisory
7	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html	Mailing List Third Party Advisory
8	http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html	Mailing List Third Party Advisory
9	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html	Mailing List Third Party Advisory
10	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html	Mailing List Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html	Mailing List Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html	Mailing List Third Party Advisory
13	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html	Mailing List Third Party Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html	Mailing List Third Party Advisory
15	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html	Mailing List Third Party Advisory
16	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html	Mailing List Third Party Advisory
17	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html	Mailing List Third Party Advisory
18	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html	Mailing List Third Party Advisory
19	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html	Mailing List Third Party Advisory
20	http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html	Mailing List Third Party Advisory
21	http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html	Third Party Advisory VDB Entry
22	http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html	Third Party Advisory VDB Entry
23	http://seclists.org/fulldisclosure/2016/Jan/44	Mailing List Third Party Advisory
24	http://seclists.org/fulldisclosure/2016/Jan/44	Mailing List Third Party Advisory
25	http://www.debian.org/security/2016/dsa-3446	Third Party Advisory
26	http://www.debian.org/security/2016/dsa-3446	Third Party Advisory
27	http://www.openssh.com/txt/release-7.1p2	Patch Release Notes Vendor Advisory
28	http://www.openssh.com/txt/release-7.1p2	Patch Release Notes Vendor Advisory
29	http://www.openwall.com/lists/oss-security/2016/01/14/7	Exploit Mailing List Technical Description Third Party Advisory
30	http://www.openwall.com/lists/oss-security/2016/01/14/7	Exploit Mailing List Technical Description Third Party Advisory
31	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
32	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html	Third Party Advisory
33	http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	Third Party Advisory
34	http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	Third Party Advisory
35	http://www.securityfocus.com/archive/1/537295/100/0/threaded	Third Party Advisory VDB Entry
36	http://www.securityfocus.com/archive/1/537295/100/0/threaded	Third Party Advisory VDB Entry
37	http://www.securityfocus.com/bid/80698	Third Party Advisory VDB Entry
38	http://www.securityfocus.com/bid/80698	Third Party Advisory VDB Entry
39	http://www.securitytracker.com/id/1034671	Third Party Advisory VDB Entry
40	http://www.securitytracker.com/id/1034671	Third Party Advisory VDB Entry
41	http://www.ubuntu.com/usn/USN-2869-1	Third Party Advisory
42	http://www.ubuntu.com/usn/USN-2869-1	Third Party Advisory
43	https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/	Release Notes Vendor Advisory
44	https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/	Release Notes Vendor Advisory
45	https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/	Release Notes Vendor Advisory
46	https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/	Release Notes Vendor Advisory
47	https://bto.bluecoat.com/security-advisory/sa109	Third Party Advisory
48	https://bto.bluecoat.com/security-advisory/sa109	Third Party Advisory
49	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
50	https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
51	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375	Third Party Advisory
52	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375	Third Party Advisory
53	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388	Third Party Advisory
54	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388	Third Party Advisory
55	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680	Third Party Advisory
56	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680	Third Party Advisory
57	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722	Third Party Advisory
58	https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722	Third Party Advisory
59	https://security.gentoo.org/glsa/201601-01	Third Party Advisory
60	https://security.gentoo.org/glsa/201601-01	Third Party Advisory
61	https://support.apple.com/HT206167	Vendor Advisory
62	https://support.apple.com/HT206167	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:openbsd:openssh:5.4:::::::*
cpe:2.3:a:openbsd:openssh:5.5:::::::*
cpe:2.3:a:openbsd:openssh:6.6:::::::*
cpe:2.3:a:openbsd:openssh:6.7:::::::*
cpe:2.3:a:openbsd:openssh:5.4:p1::::::
cpe:2.3:a:openbsd:openssh:6.2:p1::::::
cpe:2.3:a:openbsd:openssh:6.9:::::::*
cpe:2.3:a:openbsd:openssh:6.8:p1::::::
cpe:2.3:a:openbsd:openssh:5.7:p1::::::
cpe:2.3:a:openbsd:openssh:6.0:::::::*
cpe:2.3:a:openbsd:openssh:6.3:::::::*
cpe:2.3:a:openbsd:openssh:6.1:p1::::::
cpe:2.3:a:openbsd:openssh:5.9:::::::*
cpe:2.3:a:openbsd:openssh:6.5:p1::::::
cpe:2.3:a:openbsd:openssh:6.1:::::::*
cpe:2.3:a:openbsd:openssh:6.3:p1::::::
cpe:2.3:a:openbsd:openssh:7.0:p1::::::
cpe:2.3:a:openbsd:openssh:5.6:p1::::::
cpe:2.3:a:openbsd:openssh:5.9:p1::::::
cpe:2.3:a:openbsd:openssh:7.1:::::::*
cpe:2.3:a:openbsd:openssh:5.8:::::::*
cpe:2.3:a:openbsd:openssh:6.0:p1::::::
cpe:2.3:a:openbsd:openssh:6.8:::::::*
cpe:2.3:a:openbsd:openssh:5.7:::::::*
cpe:2.3:a:openbsd:openssh:6.4:::::::*
cpe:2.3:a:openbsd:openssh:6.6:p1::::::
cpe:2.3:a:openbsd:openssh:6.5:::::::*
cpe:2.3:a:openbsd:openssh:6.7:p1::::::
cpe:2.3:a:openbsd:openssh:6.2:::::::*
cpe:2.3:a:openbsd:openssh:7.0:::::::*
cpe:2.3:a:openbsd:openssh:5.8:p1::::::
cpe:2.3:a:openbsd:openssh:6.9:p1::::::
cpe:2.3:a:openbsd:openssh:7.1:p1::::::
cpe:2.3:a:openbsd:openssh:5.5:p1::::::
cpe:2.3:a:openbsd:openssh:5.6:::::::*
cpe:2.3:a:openbsd:openssh:6.4:p1::::::
cpe:2.3:a:openbsd:openssh:6.2:p2::::::